CVE-2019-6851

Schneider Electric Modicon M580 series PLCs are affected by CVE-2019-6851 (CWE-538) via the TFTP server, enabling unauthenticated disclosure of sensitive files. Affected devices include Modicon M580 and older Modicon controllers (M340, Premium, Quantum) across all firmware versions as described b...

CVE-2019-6851

A CWE-538: File and Directory Information Exposure vulnerability exists in Modicon M580, Modicon M340, Modicon Premium , Modicon Quantum all firmware versions, which could cause the disclosure of information from the controller when using TFTP protocol...

CVE-2019-6850

A CWE-200: Information Exposure vulnerability exists in Modicon M580, Modicon BMENOC 0311, and Modicon BMENOC 0321, which could cause the disclosure of sensitive information when reading specific registers with the REST API of the controller/communication module...

CVE-2019-6850

The CVE-2019-6850 issue affects Schneider Electric Modicon M580 and BMENOC 0311/0321. The vulnerability is an information disclosure (CWE-200) that occurs when reading specific registers via the controller/communication module REST API, allowing exposure of sensitive data. Root cause is informati...

CVE-2019-6849

CVE-2019-6849 affects Schneider Electric Modicon M580 controllers and BMENOC 0311/0321 modules, where certain Modbus REST API services may disclose sensitive information. The root cause is an information-exposure vulnerability (CWE-200) in the Modbus services exposed by the controller/communicati...

CVE-2019-6849

A CWE-200: Information Exposure vulnerability exists in Modicon M580, Modicon BMENOC 0311, and Modicon BMENOC 0321, which could cause the disclosure of sensitive information when using specific Modbus services provided by the REST API of the controller/communication module...

CVE-2019-6848

A CWE-755: Improper Handling of Exceptional Conditions vulnerability exists in Modicon M580 CPU BMEx58 and Modicon M580 communication module BMENOC0311, BMENOC0321 see notification for version info, which could cause a Denial of Service attack on the PLC when sending specific data on the REST API...

CVE-2019-6848

CVE-2019-6848 affects Schneider Electric’s Modicon M580 family — specifically the CPU BMEx58* and the BMENOC0311/BMENOC0321 communication modules. The root cause is a CWE-755 improper handling of exceptional conditions, which could allow a Denial of Service against the PLC when specific data is s...

CVE-2019-6847

CVE-2019-6847 affects Schneider Electric Modicon M580, M340, BMxCRA, and 140CRA programmable controllers. The issue is a denial-of-service flaw in the FTP firmware-update path, where upgrading to an incompatible firmware image can drive the device into a non-recoverable fault, stopping remote com...

CVE-2019-6847

A CWE-755: Improper Handling of Exceptional Conditions vulnerability exists in Modicon M580, Modicon M340, Modicon BMxCRA and 140CRA modules all firmware versions, which could cause a Denial of Service attack on the FTP service when upgrading the firmware with a version incompatible with the...

CVE-2019-6846

A CWE-319: Cleartext Transmission of Sensitive Information vulnerability exists in Modicon M580, Modicon M340, Modicon BMxCRA and 140CRA modules all firmware versions, which could cause information disclosure when using the FTP protocol...

CVE-2019-6846

CVE-2019-6846 affects Schneider Electric Modicon M580, M340, BMxCRA and 140CRA modules (all firmware versions). The root cause is use of FTP for credential/command transmission, resulting in cleartext exposure of sensitive information to network observers. Reported impact is information disclosur...

CVE-2019-6845

The CVE-2019-6845 vulnerability affects Schneider Electric Modicon M580 (and related models) due to cleartext transmission of sensitive information via UMAS, and is tied to FTP/TFTP and device programming data paths. Talos reports an exploitable information-disclosure in UMAS with cleartext trans...

CVE-2019-6845

A CWE-319: Cleartext Transmission of Sensitive Information vulnerability exists in Modicon M580, Modicon M340, Modicon Premium , Modicon Quantum all firmware versions, which could cause the disclosure of information when transferring applications to the controller using Modbus TCP protocol...

CVE-2019-6844

A CWE-755: Improper Handling of Exceptional Conditions vulnerability exists in Modicon M580, Modicon M340, Modicon BMxCRA and 140CRA modules all firmware versions, which could cause a Denial of Service atack on the PLC when upgrading the controller with a firmware package containing an invalid we...

CVE-2019-6844

CVE-2019-6844 affects Schneider Electric Modicon M580, M340, BMxCRA and 140CRA PLC modules. The vulnerability is a Denial of Service during firmware upgrade when the firmware image for the web server is invalid and transferred via FTP; a check verifies only image headers, enabling fault state dur...

CVE-2019-6843

CVE-2019-6843 affects Schneider Electric Modicon controllers: M580 (firmware before v3.10), M340 (all firmware versions), and BMxCRA/140CRA (all firmware). The root cause is an improper handling during FTP-based firmware upgrades, where an empty firmware image can trigger a recoverable fault, cau...

CVE-2019-6843

A CWE-755: Improper Handling of Exceptional Conditions vulnerability exists in Modicon M580 with firmware version prior to V3.10, Modicon M340 all firmware versions, and Modicon BMxCRA and 140CRA modules all firmware versions, which could cause a Denial of Service attack on the PLC when upgrading...

CVE-2019-6842

A CWE-755: Improper Handling of Exceptional Conditions vulnerability exists in Modicon M580, Modicon M340, Modicon BMxCRA and 140CRA modules all firmware versions, which could cause a Denial of Service attack on the PLC when upgrading the firmware with a missing web server image inside the packag...

CVE-2019-6842

CVE-2019-6842 affects Schneider Electric Modicon M580, M340, BMxCRA, and 140CRA firmware. The root cause is improper handling of exceptional conditions in FTP-based firmware upgrade flows, which can cause a Denial of Service, stopping normal device execution after upgrade when the web server imag...